# US 2018/0324146 A1 · Zero latency gateway > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324146 A1 - Document ID: US20180324146A1 - Status: Published application - Kind: A1 - Application number: 15/770,621 - Filed: 2016-11-08 - Published: 2018-11-08 - Earliest claimed: 2015-11-17 - Assignees: ARM IP Limited - Applicants: Arm IP Limited - Inventors: Milosch Meriac - Web page: https://patentgrep.com/patent/US20180324146A1 ## CPC - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04W 4/00: Services specially adapted for wireless communication networks; Facilities therefor - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Broadly speaking, embodiments of the present technique provide apparatus, systems and methods to enable secure communication between devices. In particular, the present techniques provide an apparatus configured to monitor for a data packet transmitted between a transmitter and a receiver, determine if the data packet is permitted to be transmitted, and act on at least part of the data packet to prevent the receiver from acting on the data packet if it is not permitted to be transmitted. In other words, the present techniques provide/implement security filters in a communication channel between a transmitter and a receiver to reduce the risk that unauthorised data packets are sent to, and implemented by, the receiver device. ## Claims ### Claim 1 A method of filtering data packets transmitted between a transmitter device and a receiver device, the method comprising: monitoring, at a node device arranged between the transmitter device and the receiver device, a data packet transmitted from the transmitter device to the receiver device; determining, at the node device, if the monitored data packet is permitted to be transmitted between the transmitter device and the receiver device; distorting, responsive to the determining, at the node device, at least part of the monitored data packet if the monitored data packet is not permitted to be transmitted. ### Claim 2 (depends on 1) The method as claimed in claim 1 wherein determining if the monitored data packet is permitted to be transmitted comprises analysing the monitored data packet before the entire monitored data packet is received by the receiver device. ### Claim 3 (depends on 1) The method as claimed in claim 1 wherein determining if the monitored data packet is permitted to be transmitted comprises analysing if the monitored data packet originates from a network segment that is expected to transmit data packets to the receiver device. ### Claim 4 (depends on 1) The method as claimed in claim 1 wherein determining if the monitored data packet is permitted to be transmitted comprises analysing if the monitored data packet matches a pre-defined data packet that the receiver device is configured to receive. ### Claim 5 (depends on 1) The method as claimed in claim 1 further comprising: switching, responsive to the determining and if the monitored data packet is not permitted to be transmitted, the node device from a passive monitoring mode to an active mode; and distorting, using the node device in active mode, at least part of the monitored data packet if the data packet is not permitted to be transmitted. ### Claim 6 (depends on 1) The method as claimed in claim 1 further comprising: monitoring, at the node device, for a cryptographic token transmitted from the transmitter device to the receiver device; and monitoring, if a cryptographic token is transmitted, for the monitored data packet transmitted from the transmitter device to the receiver device. ### Claim 7 (depends on 6) The method as claimed in claim 6 further comprising: distorting, responsive to the monitoring, at the node device, at least part of the monitored data packet if the monitored data packet is not preceded by the cryptographic token. ### Claim 8 (depends on 1) The method as claimed in claim 1 further comprising: monitoring, at the node device, for a cryptographic token transmitted from the transmitter device to the receiver device over a first communication channel; and monitoring, at the node device, for the monitored data packet transmitted from the transmitter device to the receiver device over a second communication channel. ### Claim 9 (depends on 8) The method as claimed in claim 8 further comprising: distorting, responsive to the monitoring, at the node device, at least part of the monitored data packet if the cryptographic token is not received on the first communication channel before transmission of the monitored data packet from the transmitter device to the receiver device is completed. ### Claim 10 (depends on 6) The method as claimed in claim 6 further comprising: determining, responsive to the monitoring, if the cryptographic token corresponds to the monitored data packet. ### Claim 11 (depends on 10) The method as claimed in claim 10 further comprising: distorting, responsive to the determining, at the node device, at least part of the data monitored packet if the cryptographic token does not correspond to the data packet. ### Claim 12 (depends on 1) The method as claimed in claim 1 wherein distorting at least part of the monitored data packet comprises distorting a trailing checksum or cyclic redundancy check (CRC) value in the data packet, if the monitored data packet is not permitted to be transmitted. ### Claim 13 (depends on 12) The method as claimed in claim 12 wherein distorting the trailing checksum or CRC value comprises modifying the checksum or CRC value to an invalid value. ### Claim 14 (depends on 1) The method as claimed in claim 1 wherein distorting the monitored data packet comprises distorting content of the data packet to prevent the monitored data packet being implemented by the receiver device, if the monitored data packet comprises a leading checksum or cyclic redundancy check (CRC) value. ### Claim 15 (depends on 1) The method as claimed in claim 1 further comprising: receiving, at the node device, data defining one or more data packets that the receiver device is configured to receive. ### Claim 16 (depends on 1) The method as claimed in claim 1 further comprising: receiving, at the node device, data defining one or more data packets that the transmitter device is configured to send. ### Claim 17 (depends on 15) The method as claimed in claim 15 wherein receiving data comprises receiving data, at the node device, from a hub device configured to transmit the data to a plurality of node devices. ### Claim 18 (canceled) ### Claim 19 (canceled) ### Claim 20 (canceled) ### Claim 21 (canceled) ### Claim 22 (canceled) ### Claim 23 (canceled) ### Claim 24 (canceled) ### Claim 25 (canceled) ### Claim 26 (canceled) ### Claim 27 (canceled) ### Claim 28 (canceled) ### Claim 29 An apparatus for filtering data packets transmitted between a transmitter device and a receiver device, the apparatus comprising: an interface configured to monitor a data packet transmitted from the transmitter device to the receiver device; and at least one processor configured to: determine if the monitored data packet is permitted to be transmitted between the transmitter device and the receiver device, and distort, responsive to the determining, at least part of the monitored data packet if the monitored data packet is not permitted to be transmitted. ### Claim 30 (depends on 29) The apparatus as claimed in claim 29 further comprising a data store configured to store: pre-defined data on data packets that the transmitter device is configured to send; and pre-defined data on data packets that the receiver device is configured to receive; wherein the processor is configured to determine if the monitored data packet is permitted to be transmitted between the transmitter device and the receiver device by comparing the monitored data packet to the pre-defined data in the data store. ### Claim 31 (canceled) ### Claim 32 A system for filtering data packets, the system comprising: a transmitter device and a receiver device arranged in communication via a communication channel; and a node device arranged between the transmitter device and the receiver device and configured to: monitor a data packet transmitted from the transmitter device to the receiver device over the communication channel; determine if the monitored data packet is permitted to be transmitted between the transmitter device and the receiver device; and distort, responsive to the determining, at least part of the monitored data packet if the monitored data packet is not permitted to be transmitted. ### Claim 33 (canceled) ### Claim 34 (canceled) ### Claim 35 (canceled) ### Claim 36 (canceled) ### Claim 37 (canceled) ### Claim 38 (canceled)